Skip to main content

Forensic differentiator

Project description

docs/images/diffy_small.png Travis CI Codecov https://img.shields.io/gitter/room/nwjs/nw.js.svg?style=flat-square PyPi version Supported Python versions License Status RTD

Diffy is a digital forensics and incident response (DFIR) tool developed by Netflix’s Security Intelligence and Response Team (SIRT).

Diffy allows a forensic investigator to quickly scope a compromise across cloud instances during an incident, and triage those instances for followup actions. Diffy is currently focused on Linux instances running within Amazon Web Services (AWS), but owing to our plugin structure, could support multiple platforms and cloud providers.

It’s called “Diffy” because it helps a human investigator to identify the differences between instances, and because Alex pointed out that “The Difforensicator” was unnecessarily tricky.

See Releases for recent changes. See our Read the Docs site for well-formatted documentation.

Supported Technologies

  • AWS (AWS Systems Manager / SSM)
  • Local
  • osquery

Each technology has its own plugins for targeting, collection and persistence.

Features

  • Efficiently highlights outliers in security-relevant instance behavior. For example, you can use Diffy to tell you which of your instances are listening on an unexpected port, are running an unusual process, include a strange crontab entry, or have inserted a surprising kernel module.

  • Uses one, or both, of two methods to highlight differences:

    • Collection of a “functional” baseline from a “clean” running instance, against which your instance group is compared, and
    • Collection of a “clustered” baseline, in which all instances are surveyed, and outliers are made obvious.
  • Uses a modular plugin-based architecture. We currently include plugins for collection using osquery via AWS Systems Manager (formerly known as Simple Systems Manager or SSM).

Installation

Via pip:

pip install diffy

Roadmap

We are actively adding more plugins & tests, and improving the documentation.

Why python 3 only?

Please see Guido’s guidance regarding the Python 2.7 end of life date.

Project details


Release history Release notifications

This version
History Node

0.1.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
diffy-0.1.0-py2.py3-none-any.whl (47.3 kB) Copy SHA256 hash SHA256 Wheel py2.py3
diffy-0.1.0.tar.gz (31.1 kB) Copy SHA256 hash SHA256 Source None

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page